Snowflake vulnerabilities

CVEs per yearBy the year they were published

1. 20251
2. 202623

Newest CVEs

• CVE-2026-123859

  SQL Injection via unescaped DataFrame column names in Snowflake Connector for Python and Snowflake Connector for Python (Universal Core)

  Snowflake · Snowflake Connector for Python

  High8.1
• CVE-2026-121925

  Buffer overflow in SAML authentication post-back URL handling in libsnowflakeclient and Snowflake PHP PDO Driver

  Snowflake · Snowflake PHP PDO Driver

  Medium6.6
• CVE-2026-114456

  Missing origin validation for the externalbrowser authenticator callback in multiple Snowflake client drivers

  Snowflake · Snowflake Connector for Python

  Medium6.5
• CVE-2026-92903

  Improper Input Validation in Snowflake CLI Versions Allow Unsanitized User-Controlled Values to be Interpolated into SQL Strings

  Snowflake · Snowflake CLI

  High8.2
• CVE-2026-86600

  Workload identity attestation generated before login host validation in Snowflake drivers

  Snowflake · Snowflake Connector for Python

  High8.2
• CVE-2026-86597

  Sensitive information written to logs by Snowflake drivers

  Snowflake · Snowflake Connector for Python

  Medium6.5
• CVE-2026-85528

  Snowflake JDBC Driver auto-configuration account validation permits credential redirection

  Snowflake · Snowflake JDBC Driver

  Medium5.3
• CVE-2026-85525

  Improper OCSP response validation in Snowflake drivers

  Snowflake · Snowflake Connector for Python

  High7.4
• CVE-2026-19594

  Path Traversal and HTTP Parameter Pollution in Snowflake Python API (snowflake.core) Allow Confused-Deputy Privilege Escalation

  Snowflake · Snowflake Python APIs

  High8.1
• CVE-2026-16870

  Multiple Security Vulnerabilities in Snowflake libsnowflakeclient

  Snowflake · Snowflake libsnowflakeclient

  High8.8